Several new security checks have been added to the Bash tool's command validation, particularly for Windows/PowerShell:
- WMI process spawning detection: Commands that "can spawn arbitrary processes via WMI/CIM (Win32_Process Create)" are now flagged for manual approval
- Glob pattern symlink validation: "Glob patterns in paths cannot be statically validated — symlinks inside the glob expansion are not examined"
- Archive + git exploit prevention: "Compound command extracts an archive and runs git. Archive contents may plant bare-repository indicators (HEAD, hooks/, refs/) that git then treats as the repository root"
- Filesystem link creation blocking: "Compound command creates a filesystem link (New-Item -ItemType SymbolicLink/Junction/HardLink) — cannot auto-allow because path validation cannot follow just-created links"
- New-PSDrive directory change detection: Added to the compound command directory-change check alongside Set-Location, Push-Location, and Pop-Location
- Command length validation: Input length limits now measured in bytes with explicit error message
- Windows archive tools:
bsdtar.exeandgunzip.exeadded to the allowed archive tool list
Evidence
WMI check (search for "can spawn arbitrary processes via WMI/CIM"), glob check (search for "Glob patterns in paths cannot be statically validated")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.